'Persistent intrusion' involves long-term monitoring to gain psychological and behavioral insight. The industry has evolved, it's not always just about running a keylogger and capturing some files, anymore. Some example of what persistent intrusion is about: running a 'wmctrl' equivalent every 12 seconds to capture classes and titles of windows currently opened, which is then uploaded and assessed. Keyboard typing patterns are also captured. Your music collection is captured, including which tracks you listen to and how often. Over the course of months/years an large amount of information is ultimately collected which is then sent to a team of data scientists and psychologists for data mining and analysis. The wealth of information allows you to predict the target's thought patterns and movements.
The microphone is NOT captured for standard targets.
Persistent intrusion is easier to prevent:
- Prefer Linux to OSX/windows. Prefer Arch or similar but Ubuntu is infinitely better than OSX/windows.
- If you are using Ubuntu, never download apt-get packages over http (the default), switch to a mirror that uses https. The reason is there is MITM monitoring on the packages you are downloading in order to look for packages they need to find exploits in, and to gain information about your system.
- Obviously, never connect to a website unencrypted. The connection will be MITM'd, a 0day will be injected in-flight on the return path from the remote host and your browser will crash.
- On Linux, in the event of a normal crash, never use the crash reporters to send a crash report. The connection will be MITM'd, a 0day will be injected in-flight on the return path from the crash acknowledgement server.
- Routinely reinstall your operating system every 2-3 weeks. It's easy on Linux and you can automate the install using scripts. Additionally you can mount your home directory seperately. Physically change the installation drive.
Unfortunately, incidental (one-off) intrusion is more difficult to stop since assumedly a single attack is all it will take to lose your data on disk, if this is the resource you are trying to protect.
Even if you are not a high profile target, any connection to a VPN or TOR is monitored, and your IP address is added to an array and entered into a lottery for penetration.